Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

e284501ae5...67.exe

windows7-x64

10

e284501ae5...67.exe

windows10-2004-x64

10

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/12/2024, 19:37 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe

  • Size

    419KB

  • MD5

    1194e870e252e43b41cc724c1c7a987e

  • SHA1

    e7a95416ebc253d9fe01fb3c90c6fa713143436d

  • SHA256

    e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367

  • SHA512

    d88e334a88740a5d71666757bc5309414deefe82c4bd601ea9d7dec1fc54cead898f750215028fef8026b7a948a7f184e4b06a0c9eb6e99e0ad55b014733b101

  • SSDEEP

    12288:bch7SSzvYNxbs0V0utVFWN5yUBHWpwyx9fag6vI:bqvv2Vx0urqwg4xyrvI

Score
10/10
guloaderdiscoverydownloader

Malware Config

Signatures

  • Guloader family
    guloader
  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

    downloaderguloader
  • Loads dropped DLL 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
    "C:\Users\Admin\AppData\Local\Temp\e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Users\Admin\AppData\Local\Temp\e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      "C:\Users\Admin\AppData\Local\Temp\e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • System Location Discovery: System Language Discovery
      PID:2340
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2340 -s 1828
        3⤵
        • Program crash
        PID:668
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2340 -ip 2340
    1⤵
      PID:2320

    Network

    • flag-us
      DNS
      232.168.11.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      232.168.11.51.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      74.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      74.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      drive.google.com
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      Remote address:
      8.8.8.8:53
      Request
      drive.google.com
      IN A
      Response
      drive.google.com
      IN A
      172.217.169.78
    • flag-gb
      GET
      https://drive.google.com/uc?export=download&id=1oXRGsBJFRkgimIjqP0Gnbo7nHLeypb02
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      Remote address:
      172.217.169.78:443
      Request
      GET /uc?export=download&id=1oXRGsBJFRkgimIjqP0Gnbo7nHLeypb02 HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
      Host: drive.google.com
      Cache-Control: no-cache
      Response
      HTTP/1.1 303 See Other
      Content-Type: application/binary
      Cache-Control: no-cache, no-store, max-age=0, must-revalidate
      Pragma: no-cache
      Expires: Mon, 01 Jan 1990 00:00:00 GMT
      Date: Fri, 06 Dec 2024 19:38:04 GMT
      Location: https://drive.usercontent.google.com/download?id=1oXRGsBJFRkgimIjqP0Gnbo7nHLeypb02&export=download
      Strict-Transport-Security: max-age=31536000
      Cross-Origin-Opener-Policy: same-origin
      Permissions-Policy: ch-ua-arch=*, ch-ua-bitness=*, ch-ua-full-version=*, ch-ua-full-version-list=*, ch-ua-model=*, ch-ua-wow64=*, ch-ua-form-factors=*, ch-ua-platform=*, ch-ua-platform-version=*
      Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport
      Content-Security-Policy: script-src 'nonce-zdfW1nYjBiyBBlj09dTBtw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'
      Content-Security-Policy: script-src 'unsafe-inline' 'unsafe-eval' blob: data: 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/DriveUntrustedContentHttp/cspreport/allowlist
      Content-Security-Policy-Report-Only: script-src 'unsafe-inline' 'unsafe-eval' blob: data: https://translate.google.com/translate_a/element.js https://www.google-analytics.com/analytics.js https://translate.googleapis.com/_/translate_http/_/js/;report-uri /_/DriveUntrustedContentHttp/cspreport/fine-allowlist
      Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
      Server: ESF
      Content-Length: 0
      X-XSS-Protection: 0
      X-Frame-Options: SAMEORIGIN
      X-Content-Type-Options: nosniff
      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    • flag-us
      DNS
      c.pki.goog
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      Remote address:
      8.8.8.8:53
      Request
      c.pki.goog
      IN A
      Response
      c.pki.goog
      IN CNAME
      pki-goog.l.google.com
      pki-goog.l.google.com
      IN A
      142.250.178.3
    • flag-gb
      GET
      http://c.pki.goog/r/r1.crl
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      Remote address:
      142.250.178.3:80
      Request
      GET /r/r1.crl HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/10.0
      Host: c.pki.goog
      Response
      HTTP/1.1 200 OK
      Accept-Ranges: bytes
      Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
      Cross-Origin-Resource-Policy: cross-origin
      Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
      Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
      Content-Length: 854
      X-Content-Type-Options: nosniff
      Server: sffe
      X-XSS-Protection: 0
      Date: Fri, 06 Dec 2024 19:15:02 GMT
      Expires: Fri, 06 Dec 2024 20:05:02 GMT
      Cache-Control: public, max-age=3000
      Age: 1382
      Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
      Content-Type: application/pkix-crl
      Vary: Accept-Encoding
    • flag-us
      DNS
      78.169.217.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      78.169.217.172.in-addr.arpa
      IN PTR
      Response
      78.169.217.172.in-addr.arpa
      IN PTR
      lhr48s09-in-f141e100net
    • flag-us
      DNS
      3.178.250.142.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      3.178.250.142.in-addr.arpa
      IN PTR
      Response
      3.178.250.142.in-addr.arpa
      IN PTR
      lhr48s27-in-f31e100net
    • flag-us
      DNS
      o.pki.goog
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      Remote address:
      8.8.8.8:53
      Request
      o.pki.goog
      IN A
      Response
      o.pki.goog
      IN CNAME
      pki-goog.l.google.com
      pki-goog.l.google.com
      IN A
      142.250.178.3
    • flag-gb
      GET
      http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEGoFYJ0C3qQCbRh5xcgwPQ%3D
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      Remote address:
      142.250.178.3:80
      Request
      GET /wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEGoFYJ0C3qQCbRh5xcgwPQ%3D HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/10.0
      Host: o.pki.goog
      Response
      HTTP/1.1 200 OK
      Server: ocsp_responder
      Content-Length: 471
      X-XSS-Protection: 0
      X-Frame-Options: SAMEORIGIN
      Date: Fri, 06 Dec 2024 19:11:49 GMT
      Cache-Control: public, max-age=14400
      Content-Type: application/ocsp-response
      Age: 1575
    • flag-gb
      GET
      http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDHA1yyGqTiRQmAB36tPEBH
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      Remote address:
      142.250.178.3:80
      Request
      GET /wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDHA1yyGqTiRQmAB36tPEBH HTTP/1.1
      Connection: Keep-Alive
      Accept: */*
      User-Agent: Microsoft-CryptoAPI/10.0
      Host: o.pki.goog
      Response
      HTTP/1.1 200 OK
      Server: ocsp_responder
      Content-Length: 472
      X-XSS-Protection: 0
      X-Frame-Options: SAMEORIGIN
      Date: Fri, 06 Dec 2024 19:09:08 GMT
      Cache-Control: public, max-age=14400
      Content-Type: application/ocsp-response
      Age: 1736
    • flag-us
      DNS
      drive.usercontent.google.com
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      Remote address:
      8.8.8.8:53
      Request
      drive.usercontent.google.com
      IN A
      Response
      drive.usercontent.google.com
      IN A
      216.58.212.193
    • flag-gb
      GET
      https://drive.usercontent.google.com/download?id=1oXRGsBJFRkgimIjqP0Gnbo7nHLeypb02&export=download
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      Remote address:
      216.58.212.193:443
      Request
      GET /download?id=1oXRGsBJFRkgimIjqP0Gnbo7nHLeypb02&export=download HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:131.0) Gecko/20100101 Firefox/131.0
      Cache-Control: no-cache
      Host: drive.usercontent.google.com
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Content-Type: application/octet-stream
      Content-Security-Policy: sandbox
      Content-Security-Policy: default-src 'none'
      Content-Security-Policy: frame-ancestors 'none'
      X-Content-Security-Policy: sandbox
      Cross-Origin-Opener-Policy: same-origin
      Cross-Origin-Embedder-Policy: require-corp
      Cross-Origin-Resource-Policy: same-site
      X-Content-Type-Options: nosniff
      Content-Disposition: attachment; filename="WGDHRzDfvgNEb216.bin"
      Access-Control-Allow-Origin: *
      Access-Control-Allow-Credentials: false
      Access-Control-Allow-Headers: Accept, Accept-Language, Authorization, Cache-Control, Content-Disposition, Content-Encoding, Content-Language, Content-Length, Content-MD5, Content-Range, Content-Type, Date, developer-token, financial-institution-id, X-Goog-Sn-Metadata, X-Goog-Sn-PatientId, GData-Version, google-cloud-resource-prefix, linked-customer-id, login-customer-id, x-goog-request-params, Host, If-Match, If-Modified-Since, If-None-Match, If-Unmodified-Since, Origin, OriginToken, Pragma, Range, request-id, Slug, Transfer-Encoding, hotrod-board-name, hotrod-chrome-cpu-model, hotrod-chrome-processors, Want-Digest, X-Ad-Manager-Impersonation, x-chrome-connected, X-ClientDetails, X-Client-Pctx, X-Client-Version, x-debug-settings-metadata, X-Firebase-Locale, X-Goog-Firebase-Installations-Auth, X-Firebase-Client, X-Firebase-Client-Log-Type, X-Firebase-GMPID, X-Firebase-Auth-Token, X-Firebase-AppCheck, X-Firebase-Token, X-Goog-Drive-Client-Version, X-Goog-Drive-Resource-Keys, X-GData-Client, X-GData-Key, X-GoogApps-Allowed-Domains, X-Goog-AdX-Buyer-Impersonation, X-Goog-Api-Client, X-Goog-Visibilities, X-Goog-AuthUser, X-Google-EOM, x-goog-ext-124712974-jspb, x-goog-ext-467253834-jspb, x-goog-ext-353267353-bin, x-goog-ext-353267353-jspb, x-goog-ext-251363160-jspb, x-goog-ext-259736195-jspb, x-goog-ext-477772811-jspb, x-goog-ext-359275022-bin, x-goog-ext-328800237-jspb, x-goog-ext-202735639-bin, x-goog-ext-223435598-bin, X-Goog-PageId, X-Goog-Encode-Response-If-Executable, X-Goog-Correlation-Id, X-Goog-Request-Info, X-Goog-Request-Reason, X-Goog-Request-Time, X-Goog-Experiments, x-goog-iam-authority-selector, x-goog-iam-authorization-token, X-Goog-Spatula, X-Goog-Travel-Bgr, X-Goog-Travel-Settings, X-Goog-Upload-Command, X-Goog-Upload-Content-Disposition, X-Goog-Upload-Content-Length, X-Goog-Upload-Content-Type, X-Goog-Upload-File-Name, X-Goog-Upload-Header-Content-Encoding, X-Goog-Upload-Header-Content-Length, X-Goog-Upload-Header-Content-Type, X-Goog-Upload-Header-Transfer-Encoding, X-Goog-Upload-Offset, X-Goog-Upload-Protocol, x-goog-user-project, X-Goog-Visitor-Id, X-Goog-FieldMask, X-Google-Project-Override, x-goog-maps-api-salt, x-goog-maps-api-signature, x-goog-maps-client-id, X-Goog-Api-Key, x-goog-spanner-database-role, X-HTTP-Method-Override, X-JavaScript-User-Agent, X-Pan-Versionid, X-Proxied-User-IP, X-Origin, X-Referer, X-Requested-With, X-Stadia-Client-Context, X-Upload-Content-Length, X-Upload-Content-Type, X-Use-Alt-Service, X-Use-HTTP-Status-Code-Override, X-Ios-Bundle-Identifier, X-Places-Ios-Sdk, X-Android-Package, X-Android-Cert, X-Places-Android-Sdk, X-Goog-Maps-Ios-Uuid, X-Goog-Maps-Android-Uuid, X-Ariane-Xsrf-Token, X-YouTube-Bootstrap-Logged-In, X-YouTube-VVT, X-YouTube-Page-CL, X-YouTube-Page-Timestamp, X-Compass-Routing-Destination, x-framework-xsrf-token, X-Goog-Meeting-ABR, X-Goog-Meeting-Botguardid, X-Goog-Meeting-Bot-Info, X-Goog-Meeting-ClientInfo, X-Goog-Meeting-ClientVersion, X-Goog-Meeting-Debugid, X-Goog-Meeting-Identifier, X-Goog-Meeting-Interop-Cohorts, X-Goog-Meeting-Interop-Type, X-Goog-Meeting-OidcIdToken, X-Goog-Meeting-RtcClient, X-Goog-Meeting-StartSource, X-Goog-Meeting-Token, X-Goog-Meeting-Viewer-Token, X-Client-Data, x-sdm-id-token, X-Sfdc-Authorization, MIME-Version, Content-Transfer-Encoding, X-Earth-Engine-App-ID-Token, X-Earth-Engine-Computation-Profile, X-Earth-Engine-Computation-Profiling, X-Play-Console-Experiments-Override, X-Play-Console-Session-Id, x-alkali-account-key, x-alkali-application-key, x-alkali-auth-apps-namespace, x-alkali-auth-entities-namespace, x-alkali-auth-entity, x-alkali-client-locale, EES-S7E-MODE, cast-device-capabilities, X-Server-Timeout, x-foyer-client-environment, x-goog-greenenergyuserappservice-metadata, x-goog-sherlog-context, X-Server-Token, x-rfui-request-context, x-goog-nest-jwt, X-Cloud-Trace-Context, traceparent, x-goog-chat-space-id, x-goog-pan-request-context, X-AppInt-Credentials
      Access-Control-Allow-Methods: GET,HEAD,OPTIONS
      Accept-Ranges: bytes
      Content-Length: 277056
      Last-Modified: Tue, 26 Nov 2024 06:14:11 GMT
      X-GUploader-UploadID: AFiumC79yTNBWNVyLYAQVnkXy542qR3YdtQ5ij5-5biRdAMcVPMhMa_h5LsSUvIoQTXBf7-LI-U
      Date: Fri, 06 Dec 2024 19:38:07 GMT
      Expires: Fri, 06 Dec 2024 19:38:07 GMT
      Cache-Control: private, max-age=0
      X-Goog-Hash: crc32c=IUHBRw==
      Server: UploadServer
      Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000
    • flag-us
      DNS
      193.212.58.216.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      193.212.58.216.in-addr.arpa
      IN PTR
      Response
      193.212.58.216.in-addr.arpa
      IN PTR
      ams16s21-in-f11e100net
      193.212.58.216.in-addr.arpa
      IN PTR
      ams16s21-in-f193�H
      193.212.58.216.in-addr.arpa
      IN PTR
      lhr25s27-in-f1�H
    • flag-us
      DNS
      197.87.175.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      197.87.175.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      206.23.85.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      206.23.85.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      79.190.18.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      79.190.18.2.in-addr.arpa
      IN PTR
      Response
      79.190.18.2.in-addr.arpa
      IN PTR
      a2-18-190-79deploystaticakamaitechnologiescom
    • flag-us
      DNS
      30.243.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      30.243.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      30.243.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      30.243.111.52.in-addr.arpa
      IN PTR
    • 172.217.169.78:443
      https://drive.google.com/uc?export=download&id=1oXRGsBJFRkgimIjqP0Gnbo7nHLeypb02
      tls, http
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      1.2kB
       9.2kB
       14
      11

      HTTP Request

      GET https://drive.google.com/uc?export=download&id=1oXRGsBJFRkgimIjqP0Gnbo7nHLeypb02

      HTTP Response

      303
    • 142.250.178.3:80
      http://c.pki.goog/r/r1.crl
      http
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      349 B
       1.7kB
       5
      4

      HTTP Request

      GET http://c.pki.goog/r/r1.crl

      HTTP Response

      200
    • 142.250.178.3:80
      http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDHA1yyGqTiRQmAB36tPEBH
      http
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      784 B
       1.6kB
       7
      4

      HTTP Request

      GET http://o.pki.goog/wr2/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEEGoFYJ0C3qQCbRh5xcgwPQ%3D

      HTTP Response

      200

      HTTP Request

      GET http://o.pki.goog/wr2/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRTQtSEi8EX%2BbYUTXd8%2ByMxD3s1zQQU3hse7XkV1D43JMMhu%2Bw0OW1CsjACEQDHA1yyGqTiRQmAB36tPEBH

      HTTP Response

      200
    • 216.58.212.193:443
      https://drive.usercontent.google.com/download?id=1oXRGsBJFRkgimIjqP0Gnbo7nHLeypb02&export=download
      tls, http
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      10.9kB
       301.6kB
       225
      222

      HTTP Request

      GET https://drive.usercontent.google.com/download?id=1oXRGsBJFRkgimIjqP0Gnbo7nHLeypb02&export=download

      HTTP Response

      200
    • 8.8.8.8:53
      232.168.11.51.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      232.168.11.51.in-addr.arpa

    • 8.8.8.8:53
      74.32.126.40.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      74.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      drive.google.com
      dns
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      62 B
       78 B
       1
      1

      DNS Request

      drive.google.com

      DNS Response

      172.217.169.78

    • 8.8.8.8:53
      c.pki.goog
      dns
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      56 B
       107 B
       1
      1

      DNS Request

      c.pki.goog

      DNS Response

      142.250.178.3

    • 8.8.8.8:53
      78.169.217.172.in-addr.arpa
      dns
      73 B
       112 B
       1
      1

      DNS Request

      78.169.217.172.in-addr.arpa

    • 8.8.8.8:53
      3.178.250.142.in-addr.arpa
      dns
      72 B
       110 B
       1
      1

      DNS Request

      3.178.250.142.in-addr.arpa

    • 8.8.8.8:53
      o.pki.goog
      dns
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      56 B
       107 B
       1
      1

      DNS Request

      o.pki.goog

      DNS Response

      142.250.178.3

    • 8.8.8.8:53
      drive.usercontent.google.com
      dns
      e284501ae59fcc3f04a7494637a3ae8ff5bb223e333f7c25cbedd322893d5367.exe
      74 B
       90 B
       1
      1

      DNS Request

      drive.usercontent.google.com

      DNS Response

      216.58.212.193

    • 8.8.8.8:53
      193.212.58.216.in-addr.arpa
      dns
      73 B
       171 B
       1
      1

      DNS Request

      193.212.58.216.in-addr.arpa

    • 8.8.8.8:53
      197.87.175.4.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      197.87.175.4.in-addr.arpa

    • 8.8.8.8:53
      206.23.85.13.in-addr.arpa
      dns
      71 B
       145 B
       1
      1

      DNS Request

      206.23.85.13.in-addr.arpa

    • 8.8.8.8:53
      79.190.18.2.in-addr.arpa
      dns
      70 B
       133 B
       1
      1

      DNS Request

      79.190.18.2.in-addr.arpa

    • 8.8.8.8:53
      30.243.111.52.in-addr.arpa
      dns
      144 B
       158 B
       2
      1

      DNS Request

      30.243.111.52.in-addr.arpa

      DNS Request

      30.243.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\nsp8686.tmp\System.dll
      Filesize

      11KB

      MD5

      17ed1c86bd67e78ade4712be48a7d2bd

      SHA1

      1cc9fe86d6d6030b4dae45ecddce5907991c01a0

      SHA256

      bd046e6497b304e4ea4ab102cab2b1f94ce09bde0eebba4c59942a732679e4eb

      SHA512

      0cbed521e7d6d1f85977b3f7d3ca7ac34e1b5495b69fd8c7bfa1a846baf53b0ecd06fe1ad02a3599082ffacaf8c71a3bb4e32dec05f8e24859d736b828092cd5

      Download Submit

    • memory/228-12-0x00000000040F0000-0x0000000004ABB000-memory.dmp

      Filesize

      9.8MB

      Download

    • memory/228-13-0x0000000077C61000-0x0000000077D81000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/228-14-0x0000000010004000-0x0000000010005000-memory.dmp

      Filesize

      4KB

      Download

    • memory/228-15-0x00000000040F0000-0x0000000004ABB000-memory.dmp

      Filesize

      9.8MB

      Download

    • memory/2340-16-0x00000000016C0000-0x000000000208B000-memory.dmp

      Filesize

      9.8MB

      Download

    • memory/2340-17-0x0000000077CE8000-0x0000000077CE9000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2340-18-0x0000000077D05000-0x0000000077D06000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2340-32-0x00000000016C0000-0x000000000208B000-memory.dmp

      Filesize

      9.8MB

      Download

    • memory/2340-31-0x0000000000460000-0x00000000016B4000-memory.dmp

      Filesize

      18.3MB

      Download

    • memory/2340-34-0x0000000077C61000-0x0000000077D81000-memory.dmp

      Filesize

      1.1MB

      Download

    • memory/2340-35-0x00000000016C0000-0x000000000208B000-memory.dmp

      Filesize

      9.8MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.